A customer appears large area TSM client sever report violations in Oct 10th, 2011, after checking we find that the trend firewall client haven’t been updated for 15 days.
Trough checking the trend server, we find that the anti-virus software server can’t be updates because of the server crashed in Oct, 31th.
Through checking the log of TSM client server, we find the latest time the update message obtained from anti-virus client is Oct, 14, 2011. As the violation of the update time is 15 days, so it will send illegal information that virus database is not updated. The client log information is as follows:
WARNING 2011-10-30 23:39:2 : [CheckAntiVirSoftWare] CPolicy::ExecPolicy,MakeNotifyMessage
WARNING 2011-10-30 23:39:2 : [CheckAntiVirSoftWare] 2011.10.14
WARNING 2011-10-30 23:39:2 : [CheckAntiVirSoftWare] CPolicy::ExecPolicy, Init KillAntivirus Thread Fail!
The client can update virus database normally while anti-virus server act normally.
WARNING 2011-10-31 11:39:13 : [Check Share Directory] CPolicy::ExecPolicy(): Start Sending All Shared Directory
WARNING 2011-10-31 11:39:13 : [CheckAntiVirSoftWare] 2011.10.30
TSM reports violations because of the anti-virus software can’t update. We can solve the problem by checking the log of TSM client when TSM client appears large area problems.